Hacking the Spy Video Trakr

8/17/2019 Hacking the Spy Video Trakr

1/18

Hacking the Spy Video Trakr by KRA5H

Download 22 StepsShare

Favorite I Made it! Collection

he rar is a re"ote controlled robot e#$ipped with a "icrophone and color

video ca"era% speaer% a near in&rared '(D &or ni)ht vision% an SD "e"ory card

slot &or recordin) a$dio*video and +M, o& on board "e"ory &or storin)

downloadable and $ser desi)ned pro)ra"s- he re"ote control $nit has control

levers to drive the robot% a speaer and color video display so yo$ can hear the

a$dio piced $p by the "icrophone and display the video trans"itted by the

ca"era% and several &$nction b$ttons that can be $sed to control additional pro)ra" &$nctions o& $ser desi)ned pro)ra"s- In this article we will de"onstrate

how to hac the rar- .e will show yo$ how to download and install the C

lan)$a)e co"piler &or the rar- /e0t we1ll e0plain how to co"pile a si"ple

pro)ra" and install it on the rar and then r$n this si"ple pro)ra"- Finally% we

will de"onstrate how to open $p the rar% attach $"per pins to the 34I

connections on the "ainboard o& the rar and co"pile a si"ple pro)ra" to &lash

an '(D connected to the 34I pins- 6o$ will be able to con&idently call yo$rsel&

an elite rar Hacer-

Step 1: Download and Install the C LanguageCompiler for the Trakr

.hat7s a co"piler8 Have yo$ seen those )eey 9shirts that say :there are only

;< types o& people in the world= those who $nderstand binary% and those who

don7t8: I& yo$ &ind yo$rsel& scratchin) yo$r head instead o& la$)hin) hysterically%

then yo$ don7t $nderstand binary- Co"p$ters% on the other hand% $nderstand only

binary- ;s and


2/18

6o$7ll need to download and install the C lan)$a)e co"piler so that yo$ can

write pro)ra"s &or the rar and co"pile yo$r so&tware into "achine lan)$a)e

that the rar can $nderstand- he C 'an)$a)e co"piler is incl$ded in a &airly

co"plete so&tware develop"ent it >SDK? that the &ols at .ild 4lanet call the

:4ri"er-: So% download the 4ri"er and save it on yo$r co"p$ter where it7ll beeasy to &ind by clicin) the &ollowin) lin=

http=**www-spy)ear-net*help*&iles*RAKR@A44@4RIM(R@;-2-Bip

Step 2: Download and Install the C LanguageCompiler for the Trakr (continued)

Mae a new &older in the root directory o& yo$r hard drive >$s$ally the C= drive?

called C=trar- hen open the rar 4ri"er Bip &ile yo$ downloaded &ro" the

rar web site and copy all the &iles and &olders &ro" the rar 4ri"er Bip &ile

into yo$r C=trar &older-

Step : Download and Install the C LanguageCompiler for the Trakr (continued)

/e0t yo$7ll need to $pdate the environ"ent variables to incl$de the path to the

4ri"er7s co"piler and tools- I& yo$ don7t now what environ"ent variables are%

don7t worry% yo$7re $st tellin) yo$r co"p$ter where to &ind the co"piler and the

tools it needs to co"pile yo$r rar pro)ra"s-

pen a co""and pro"pt% which is a .indows te0t based inter&ace- 3o to Start9

4ro)ra"s9Accessories9Co""and pro"pt- 6o$ will see a &lashin) c$rsor a&ter

the :: and yo$ can type te0t based co""ands- .hen yo$7re done typin) a

co""and press the (nter ey on yo$r eyboard to e0ec$te the co""and- At the

co""and pro"pt% type the &ollowin) co""ands=

cd trar

set$p

cd Internals

Step !: Download and Install the C LanguageCompiler for the Trakr (continued)

he co"piler r$ns when yo$ type :"ae: at the co""and pro"pt so yo$ need to

"ae s$re yo$ navi)ate to the &older where the "ae&ile yo$ want to r$n is

located- he co"piler then &ollows any instr$ctions in that :"ae&ile: to convert

http://www.spygear.net/help/files/TRAKR_APP_PRIMER_V1.2.ziphttp://www.spygear.net/help/files/TRAKR_APP_PRIMER_V1.2.zip


3/18

the :app-c: &ile >the te0t &ile containin) the so$rce code? into a RAKR pro)ra"-

he co"piler only loos &or the :app-c: &ile in the c$rrent &older so always na"e

yo$r so$rce code app-c- Save yo$r pro)ra"s in separate &olders with na"es

which "ae sense- his helps to eep all the vario$s :app-c: &iles or)aniBed- Asshown in the screen shot% yo$7ll want to r$n :"ae clean: in the

C=rarInternals &older- It reports all the &iles it is re"ovin) be&ore ret$rnin) the

pro"pt to yo$- hen type :"ae: at the co""and pro"pt and the co"piler will

$se the :"ae&ile: to asse"ble all the parts o& yo$r pro)ra" >which "ay incl$de

"any libraries% i"a)es and &iles speci&ied by yo$r code? into a -bin &ile to write to

the RAKR hardware-

At the :C=rarInternals: pro"pt type=

"ae clean

"ae

6o$r newly co"piled pro)ra" or app &or the rar is called :est-bin: and the

&ile will need to be copied to the rar- Mae s$re the rar is switched o&& and

connect it to yo$r co"p$ter $sin) the yellow ES, cable that ca"e with the rar-

Copy est-bin to the A44S &older inside the rar &older- Disconnect the rar

&ro" yo$r co"p$ter and switch the rar on- Switch the rar re"ote on% clic

the ho"e b$tton% and select est &ro" the "en$- It7s $st a little app that tests all

the vario$s &$nctions that yo$r rar can do s$ch as "otor tests% screen &$nctions

and so on-

Step ": Installing the #umper $ins on the%ain&oard

In this section elite rar Hacer C4@hans de"onstrates how to install "ale

header pins on the rar circ$it board=

In this section% I7" )oin) to brie&ly e0plain >with the aid o& several photos? how I

disasse"bled the rar and installed the headers- 4lease note that this proect is

not di&&ic$lt% b$t it does re#$ire so"e patience and so"e solderin) sill- I& yo$

are ine0perienced or $nco"&ortable solderin) on a printed circ$it board% yo$ can

&ollow the instr$ctions to disasse"ble the rar% and then tae it to so"eone who

can solder it &or yo$-

he 34Is and the A9to9D converter are inp$ts and o$tp$ts that can be $sed to

control thin)s- hey share a -;: pitch header- he A3 is a pro)ra""in)*testin)

port that $ses a 2"" header- I plan on e0plorin) the A3 port% to see i& I canaccess so"e capabilities there---b$t not everyone "ay be interested in doin) that-


4/18

I7" )oin) to show both% b$t yo$ can do $st the 34I i& yo$ want-

I ordered part G 4R9;


5/18

Step 1+: Installing the #umper $ins on the%ain&oard (continued)

nce the cover screws are re"oved% yo$ can p$ll the $pper and lower ho$sin)s

apart- .hen yo$ do% the e"ble" on the &ront will &all o$t- /o worries- here7salso another piece behind it that will now be loose- Set the" both aside% and

re"e"ber to replace the" when reasse"blin) the rar-

Step 11: Installing the #umper $ins on the%ain&oard (continued)

.ith the $pper ho$sin) "oved aside% yo$ can see the shiny screws holdin) in the

"ainboard- Resist the te"ptation and don7t re"ove the" yet!


nce the cover screws are re"oved it7s easy to li&t the cover eno$)h to see "ost

o& the "ain board- .hen openin) $p the cover re"e"ber to be care&$l- here are

a n$"ber o& wires that are connected between the cover and the "ainboard- he

connectors &or the wires are "od$lar% b$t to "ae the rar "ore r$))ed% the

connectors have been )l$ed to)ether- I don7t now what ind o& )l$e .ild 4lanet

$sed% b$t it "$st be EF technolo)y &ro" Area 5;! It7s to$)h st$&&! his is wherethe &in)ernail polish re"over and patience are e"ployed-


.ith a cotton swab% apply &in)ernail polish re"over to the )l$e to so&ten it $p- It

will probably tae "ore than one application- Allow the polish re"over ti"e to

soa into the )l$e- Ese the hobby ni&e to trace alon) the connector oints% and to

peel the )l$e away &ro" the connectors- /ote that the connectors also have twotabs "olded into the plastic so they7ll latch to)ether- I $sed the ni&e to release

the tabs% once the )l$e was cleaned away-

Step 1!: Installing the #umper $ins on the%ain&oard (continued)

.ith the connectors $n)l$ed and separated% yo$ can now set aside the $pper

ho$sin)- I& while tryin) to separate the connectors% yo$ end $p p$llin) the whole

thin) o&& the board% don7t &ret- he pins on the board will still be oay- I& yo$ loo

at the pic below% yo$7ll notice that I accidentally p$lled the whole connector &or


6/18

the speaer o&& o& the le&t &ront leavin) the pins sticin) $p &ro" the board- It was

easy to reattach the connectors to the naed pins once I )ot the connector

separated- I $st $sed a hot )l$e )$n to reattach it to the "ainboard-

A #$ic note- 3el&lin)L co""ented on this instr$ctable and pointed o$t the&ollowin)=

:he connectors &or the speaer% and the p$sh b$tton% are not critical% since both

are non9polar- he MIC connector% however% IS! Mae s$re yo$ p$t the socet

bac e0actly the sa"e direction% or yo$ co$ld >a? &ry the MIC ele"ent% and >b%

bvio$sly? the MIC will not pic $p anythin)!:

I& yo$ accidently re"ove the whole connector% try to reconnect it bac in its

ori)inal orientation on the circ$it board-

he rar Har co""$nity are interested in i"provin) their Instr$ctables- I& yo$

notice an error or so"ethin) they7ve &or)otten% let the" now in the co""ents

section-

Step 1": Installing the #umper $ins on the%ain&oard (continued)

,e&ore yo$ tae the "ainboard screws o$t% there7s another connector to $nhoo-

his &lat white ribbon cable is on the ri)ht &ront o& the rar% and is &or theca"era asse"bly- It7s a press$re9type connector that holds the ribbon cable

a)ainst the contacts o& the socet- o release% slide the little brown tabs >they7re

act$ally connected and r$n $nderneath the ribbon cable? &orward abo$t ;*+:---the

cable will slide ri)ht o$t-

Step 1': Installing the #umper $ins on the%ain&oard (continued)

Re"ove the &ive "ainboard screws% and $nhoo the connector to the ES, port&ro" the botto"- I le&t the power leads &ro" the battery pac soldered on% since I

had eno$)h &reedo" o& "ove"ent even with the" connected-


At this point% it7s a si"ple "atter to insert the headers into the holes on the

"ainboard% and solder the" in- 3ood solder oints are s"ooth and shiny lie

these- (ns$re that none o& the" are soldered to their nei)hbor >solder brid)e?-


7/18


At this point% it7s a si"ple "atter to insert the headers into the holes on the

"ainboard% and solder the" in- 3ood solder oints are s"ooth and shiny liethese- (ns$re that none o& the" are soldered to their nei)hbor >solder brid)e?-

6o$ can also $se .ire 3l$e http=**www-wire)l$e-$s* as an alternative to

solderin)-

/ow reverse the disasse"bly process to p$t yo$r rar bac to)ether!

Step 1*: Installing the #umper $ins on the

%ain&oard (continued)

So yo$ as% :I have pins% now what do I $se &or pl$)s8: 6o$ can order connectors

online to &it the headers% altho$)h Spar&$n doesn7t carry any- I did so"e

scro$n)in) in "y parts bo0 and &o$nd that vario$s cables &ro" old co"p$ters

will connect to the headers- he connector on the le&t is an a$dio connector $sed

to hoo CDRM drives to so$nd cards or "otherboards- It &its the 34I

spacin)- he connector on the ri)ht is the type $sed &or internal a$dio

connections% lie video capt$re cards to so$nd cards% etc- his will &it the A3

spacin)-

Step 2+: Installing the #umper $ins on the%ain&oard (continued)

I7" not sayin) these connectors will "eet all yo$r needs% b$t it at least yo$ can

"odi&y the"% and it )ives yo$ an idea o& what to loo &or in yo$r $n bo0- In the

pic below% I have two CDRM a$dio cables on the 34I---this wo$ld )ive "e A9

to9D and &ive 34I connectionsJ certainly eno$)h to play aro$nd with- ther -;:

connectors &ro" an old co"p$ter case or "otherboard >e-)- &ront panel switches%

ES, headers% chassis &ans? sho$ld be o& co"patible spacin) as well-

Step 21: ,se the -$I. $ins to /lash L0Ds(Light 0mitting Diodes)

he test to control a device $sin) the 34I connections is to switch '(Ds on and

o&& by pressin) b$ttons on the RAKR re"ote- I $sed one o& the CDRM a$dio

cables that I "entioned above- I wired the co"ponents directly to the cableJ I

didn7t really thin it was worth a circ$it board- he ;


8/18

6o$ can see how it was soldered in the $pper le&t portion o& the pict$re- .hen

yo$ r$n the trar"otorcontrol app and no b$tton is pressed% nothin) ill$"inates-

.hen b$tton A is pressed% the )reen '(D li)hts $pJ when b$tton , is pressed% the

red '(D li)hts $p-

C 'an)$a)e code=

********************************************

**'(D &lash pro)ra" &or Spy ideo RAKR

**4ro)ra" scans to see i& b$tton A was

**pressed on RAKR re"ote and sets 34C< hi)h

**and 34C; low to send c$rrent thro$)h '(D

**in &orward bias direction >switched on?-

** **I& b$tton , is pressed% it sets 34C< low

**and 34C; hi)h to send c$rrent thro$)h

**'(D in reverse direction >switched o&&?-

*******************************************

Gincl$de :svt-h: **incl$de &&icial A4I

Gincl$de :A4I-h: **incl$de :Secret sa$ce: A4I

Gde&ine 34C< >;NN


9/18

Q **i& eystate is )reater than <

i&>eyStateTK(6@I/4E;?

Q **,$tton A pressed >"otor &orward?

A4I@SetIoHi)h>34C


10/18

SH('' O sh

CC O ar"9el&9)cc

AS O ar"9el&9as

,I/ O ar"9el&9ld'D O ar"9el&9ld

4M(MR6O4M(MR6? 9.l%9Map 9.l%>basena"e U?-"ap 9nostart&iles 9static

all= preb$ild >E4E@/AM(? postb$ild

>E4E@/AM(?= >,(CS?

Uecho :'inin)--- :

Uecho :Creatin) &ile U---:

U>CC? 9$ @start 9o U >I/(R/A'S@4AH?*trar@start-a >,(CS?

>AR3(@F'A3? >'DF'A3S?

>E4E@4AH?*app-o=app-c Mae&ile

Uecho :Co"pilin) N:

U>CC? 9c 9o :U: :N: >AR3(@F'A3? >CF'A3S?

-4H/6= clean preb$ild postb$ild

clean=

>RM? 9& >4R3RAM@/AM(?-bin

>RM? 9& :>4R(6@/AM(?-bin:

>RM? 9& >E4E@4AH?*app-o

>RM? 9& >E4E@/AM(?

>RM? 9& >MKD(4FI'(?

postb$ild=

ar"9el&9obcopy 9 binary >E4E@/AM(? :>4R(6@/AM(?-bin:

Ui& V 9d :(=*: W J then

cp :>4R(6@/AM(?-bin: e=*A44S* J

&i

preb$ild=


11/18

G (nd o& Mae&ile

.hen yo$ co"pile the above code with the above "ae &ile% this will create a

rar App &ile called :trar"otorcontrol-bin: and the &ile will need to be copied

to the rar- Mae s$re the rar is switched o&& and connect it to yo$r co"p$ter

$sin) the yellow ES, cable that ca"e with the rar- Copy trar"otorcontrol-bin

to the A44S &older inside the rar &older- Disconnect the rar &ro" yo$r

co"p$ter and switch the rar on- Switch the rar re"ote on% clic the ho"e

b$tton% and select trar"otorcontrol &ro" the "en$-

6o$ can $se the trar"otorcontrol app to control "any di&&erent types o&

electrical devices---"otors% li)hts% relays% etc-

Step 22: oure an 0lite T3453 6acker7

Con)rat$lations! 6o$ "ay now call yo$rsel& an elite rar Hacer- 6o$ now

now how to download and install the C lan)$a)e co"piler &or the rar- 6o$

can $se the co"piler to co"pile pro)ra"s &or the rar- 6o$ can install c$sto"

pro)ra"s on the rar and r$n the"- For yo$ "ore darin) rar Hacers% we1ve

shown yo$ how to open $p the rar and connect e0ternal devices to the 34I

connections on the "ainboard s$ch as an '(D and control the" $sin) so&tware

yo$ have written% co"piled% and installed on the rar- Happy hacin)!

.e have a be nice co""ent policy-

4lease be positive and constr$ctive-

I Made it! Add I"a)es 4ost Co""ent

MillenniumReplya year a)o

so i& this instr$ctable is "issin) the apps and the code----Can I $se Ard$ino and code&ro" scratch ass$"in) I 4in In to 34C


12/18


13/18

Hi- I need so"eone who can help "e with so&tware * hardware &or capt$rin) "ove"enton a "ini ca"era- .ill pay top dollar with help-

Fla)

Spy_ChickensReplyP years a)o

Co$ld yo$ post the rar@App@4ri"er@;-2-Bip on "edia &ire or another downloadsyste"- the spy)ear-net website is down- he set$p loos cool b$t i can7t do anythin)$ntil I have the app- hans!

Fla)

Virtul!o"erReplyP years a)o

I never $nderstood that shirt either!

Fla)

eriedReplyP years a)o

4retty cool! there is so"e way to control the rar thr$ wi&i8 or anythin) besides there"ote8

Fla)

KRA5H >a$thor? eriedReplyP years a)oEn&ort$nately no% there is no wi&i "od$le &or the .ild 4lanet Spy ideo rar- I postedsvereal reso$rces &or the trar in this instr$ctable=

http=**www-instr$ctables-co"*id*Hacin)9the9Spy9ideo9rar9II*8A''S(4S

Hopin) so"eday so"eone will &i)$re o$t how to control it $sin) wi&i-

Fla)

KRA5H >a$thor? KRA5HReplyP years a)o

here7s the lin &or the ,roostone trar=

https=**apps-&cc-)ov*oetc&*eas*reports*iew(0hibitReport-c&"8"odeO(0hibitsTRe#$esti"eo$tO5


14/18

Fla)

cool###$Reply years a)o

I a" wonderin) i& yo$ can have the re"ote as a wireless o$t p$t b$t control &ro" yo$ pc beca$se i& yo$ )o to where the batteries are at there are 2 screws to the ri)ht >when yo$open the battery cover? and there is a "ini $sb and a switch &ro" spi to $sb

Fla)

KRA5H >a$thor? coolBBBReply years a)o

En&ort$nately% the S4I port is only &or &ir"ware $p)rades and &i0es-

So"e &ols have been tryin) to write their own*b$ildin) their own apps &or the trar

bypassin) the co"piler &or the trar- 6o$ can tae a loo at one o& the disc$ssions on thetrar &or$" here=

http=**www-spy)ear-net*&or$"*viewtopic-php8&OP


15/18

s$ch as '(Ds% relays% "otors and so on-

Clic the lin below to see waht "y app was ori)inally written &or=

http=**hacaday-co"*25*;L: dia-? &itted in per&ectly-

I piced9$p a set o& 2


16/18

Gel&lin'(Reply years a)o

he connectors &or the speaer% and the p$sh b$tton% are not critical% since both are no9 polar-- the MIC connector% however% IS! Mae s$re yo$ p$t the socet bac e0actly thesa"e direction% or yo$ co$ld >a? &ry the MIC ele"ent% and >b% bvio$sly? the MIC willnot pic $p anythin)!-

ne "ore side hac% invert the drive belts- I& yo$ tae the" o&& the wheels% 6o$7ll noticethe inside has deep teeth that "atch the drive wheels- Ironic% so does the s"all ribs onthe o$tside-- /eed serio$s traction )rip8 re"ove the trac belts% invert the" so thedeeper teeth are o$tside% and replace the" on the wheels% with the s"aller ribs inside-

Fla)

Gel&lin'(Reply years a)o

Altho$)h not noted% Inside the reset b$tton panel% i& yo$ re"ove the cover% 6o$ "i)ht or "i)ht not see a &lat piece between the screw hole% and the b$tton- I& yo$ do% yo$SHE'D be able to li&t the &lat piece o$t% and it7ll reveal two tri" 4s- hese are &or

balancin) the H9,rid)e o$tp$t o& the two drive "otors- >standard DC per"anent "a)net"otors-?

Fla)

Musicmn%1Reply years a)o

I )ot one o& these two wees a)o and planned on writin) an instr$ctable% b$t yo$ beat

"e to it- I loo &orward to $sin) yo$r in&or"ation!!Fla)

KRA5H >a$thor? M$sic"an;Reply years a)o

$tstandin)! I7" looin) &orward to readin) yo$r instr$ctable abo$t how yo$ hacedyo$r rar-

Fla)

Musicmn%1 KRA5HReply years a)o

I don7t now i& it will be soon- I a" b$t a poor colle)e st$dent with little "oney &or anard$ino-

Fla)

KRA5H >a$thor? M$sic"an;Reply years a)o

/ot s$re why yo$ wo$ld need an e0ternal "icrocontroller- he ARM processor on thetrar is decent &or "any pr)ra""in) sol$tions- I& yo$ want to drive "otors% $se an h9

brid)e- I& yo$ want to lo) data% 34C+ is an ADC pin- I& yo$ "$st $se an e0ternal"icrocontroller% yo$ "i)ht consider the I 'a$nchpad=

http://www.instructables.com/member/Gelfling6http://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/Gelfling6http://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/Musicman41http://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/KRA5Hhttp://www.instructables.com/member/Musicman41http://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/Musicman41http://www.instructables.com/member/KRA5Hhttp://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/KRA5Hhttp://www.instructables.com/member/Musicman41http://www.instructables.com/member/Gelfling6http://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/Gelfling6http://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/Musicman41http://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/KRA5Hhttp://www.instructables.com/member/Musicman41http://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/Musicman41http://www.instructables.com/member/KRA5Hhttp://www.instructables.com/id/Hacking-the-Spy-Video-Trakr/http://www.instructables.com/member/KRA5Hhttp://www.instructables.com/member/Musicman41


17/18

http=**www-ti-co"*tool*"sp9e0pP


18/18

program it to do something when your arduino detects GPC0 and GPC1 are set

to high or low depending on which buttons are pressed on the Trakr remote,

then very probably yes.

Documents

Hacking the Spy Video Trakr